Annals of Health Law Volume 26 Issue 1 Winter 2017 Article 3 2017 Enhancing Cybersecurity for the Digital Health Marketplace Charlotte A. Tschider Follow this and additional works at: https://lawecommons.luc.edu/annals Part of the Health Law and Policy Commons Recommended Citation Charlotte A. Tschider Enhancing Cybersecurity for the Digital Health Marketplace, 26 Annals Health L. 1 (2017). Available at: https://lawecommons.luc.edu/annals/vol26/iss1/3 This Article is brought to you for free and open access by LAW eCommons. It has been accepted for inclusion in Annals of Health Law by an authorized editor of LAW eCommons. For more information, please contact law- [email protected]. Tschider: Enhancing Cybersecurity for the Digital Health Marketplace Enhancing Cybersecurity for the Digital Health Marketplace Charlotte A. Tschider* 'Tis your own safety that is at stake, when your neighbour-s wall is in flarmes, and fires neglected are wont to gather strength._ - Horace INTRODUCTION The global digital health market has grown exponentially in the past five years, fueled by Internet of Things (loT) development increased mobile device adoption, and Big Data investment.2 Historically, the medical device industry focused on device implants and direct therapies, but future medical technologies also leverage network connectivity and data aggregation, necessitating comprehensive cybersecurity activities to protect consumers.3 Market leaders in digital health have recently invested heavily in technologies that simultaneously improve patient connectedness and convenience, yet increase the probability of cybersecurity threats * Charlotte A. Tschider is an Affiliated Professor with the Mitchell Hamline School of Law-s Cybersecurity and Privacy Law Program She is also Owner/Principal for a cybersecurity and privacy consulting firm, Cybersimple Security, and a Board Member for the International Association of Privacy Professionals (IAPP) Training Advisory Board. Tschider writes on a variety of topics relating to the intersection of law and technology, including privacy and cybersecurity. She holds a B.S. and M.A. in Rhetoric and Scientific and Technical Communication from the University of Minnesota, and a J.D. from the Hamline University School of Law. 1. Q. HORATIUS FLACCUs, EPISTULAE, Bk. 1, Ep. 8 in HORACE: SATIRES, EPISTLES AND ARS POETICA (H. RUSHTON FAIRCLOUGH, ED.TRANs., HARVARD UNIV. PRESS REV. ED. 1929) (c. 35 B.C.E.), http://www.archive.org/stream/satiresepistlesa00horauoft/satiresepistlesaOOhora uoftdjvu.txt. 2. Bill Chamberlin & Ed Gretz, Internet of Things: Sall loT Projects Pay the Way for Future Transforation, BLUEMINE: HORIZONWATCH (Mar. 6, 2016), http://www.slideshare. net/HorizonWatching/internet-of-things-trends-to-watch-in-2016; see also Valerie Jennings, Denver and Kansas City-Based Custom Software Development Firm Twentyseven Global, Discusses Digital Health Industry Developments, TWENTYSEVEN GLOBAL (Feb. 3, 2016), http://www.27global.com/denver-and-kansas-city-based-custom-software-development- fi rm-twentyseven-gl obal-discusses-digital-health-i ndustry-developments/. 3. Mathias Cousin, Tadashi Castillo-Hi, & Glenn Snyder, Devices and Diseases: Howthe loT is Transforing Medtech, DELOITTE UNIV. PRESS (Sept. 11, 2015), http://dupress.com articIes/internet-of-things-iot-in-medical-devices-industry/. 1 Published by LAW eCommons, 2017 1 Annals of Health Law, Vol. 26 [2017], Iss. 1, Art. 3 2 Annals of Health Law V ol. 26 compromising system vulnerabilities.4 While digital health technologies offer several benefits to patients and healthcare providers, connected technologies attract new threats, potentially resulting in both health data loss and compromise of patient physical safety.s The combination of technology connectivity with increasingly common third party involvement via the cloud, Software as a Service (SaaS), and big data, multiplies the probability of harm, due to the presence of high-vol ume data sets for multiple customers, often connected over the public Internet or home networks with unknown settings.6 The cybersecurity community, and increasingly, federal agencies, have recognized the inherent risks of connected devices both broadly within the loT and for wirelessly connected medical devices.' In 2012, as both the Office for Civil Rights (OCR) was developing its Health Insurance Portability and Accountability Act (HIPAA) audit methodology and the Federal Trade Commission (FTC) was developing cybersecurity guidelines, the Government Accountability Office (GAO) called on the U.S. Food and Drug Administration (FDA) to develop a plan to address medical device security risk.' 4. Sonali P. Gunawardhana, The Impact of Cybersecurity Vulnerabilities on Mobile Medical App Development, MED. DEVICE ONLINE (Dec. 4, 2015), http://www.rreddevice online.com'doc/the-im-pact-of-cybersecurity-vulnerabilities-on-rmobile-medical-applications- 0001. 5. CGI, CYBERPRIVACY AND CYBERSECURITY FOR HEALTH DATA 1 (2015), https:/ANww. cgi.com'sites/default/fi les/white-papers/cgi-cybersecurity-for-health-data-white-paper.pdf. 6. See generally Kimberly Crossland, 5 Big Privacy Problems that Come with Big Data, TECHOPEDIA (an. 29, 2014), https://www.techopedia.con-2/29682/trends/big-data/5-big- privacy-problems-that-come-with-big-data; see also Colin Wood, The Irmportance of Cybersecurity in the Age of the Cloud and Internet of Things, Gov -TTECH. (Oct. 2, 2014), http://www.govtech.comfsecurity/The-Im-portance-of-Cybersecurity-in-the-Age-of-the- Cloud-and-Internet-of-Things.html (explaining that Software as a Service, or SaaS, is a cloud service involving access to a Web-based application); see also Understanding the Cloud Computing Stack: SaaS, PaaS, IaaS, RACKSPACE (2016), https://support.rackspace.com' white-paper/understandi ng-the-cloud-comrputi ng-stack-saas-paas-i aas/ (juxtaposing the methodology and applicability of cloud services SaaS, Platform as a Service (PaaS), and Infrastructure as a Service (IaaS)). 7. See generally Gib Sorebo, Managing the Unanageable: A Risk Model for the Internet of Things, RSA CONF. 2015 (Apr. 2015), https://www.rsaconference.con-writable/pre sentations/file_upload/grc-rOl-managing-the-unrmnageable-a-risk-model-or-the-internet-of- things.pdf; see U.S. FED. TRADE COMM N, INTERNET OF THINGS: PRIVACY & SECURITY IN A CONNECTED WORLD 10 (an. 2015), https://www.ftc.gov/systemfiles/documents/reports/ federal-trade-comni ssi on-staff-report-november-201 3-workshop-entitled-internet-things- privacy/150127iotrpt.pdf [hereinafter FTC]; see also U.S. FOOD & DRUG ADMIN. CTR. FOR DEVICES & RADIOLOGICAL HEALTH, POSTMARKET MANAGEMENT OF CYBERSECURITY IN MED. DEVICES: DRAFT GUIDANCE FOR INDUSTRY 40an. 22, 2016), http://www.fda.gov/downloads/ medicaldevices/deviceregulationandguidance/guidancedocurrents/ucm482022.pdf (addressing the risks of data compromise inherent in redical device rermediation). 8. See generally U.S. Gov-T ACCOUNTABILITY OFF., GAO-12-816, MEDICAL DEVICES: FDA SHOULD EXPAND ITS CONSIDERATION OF INFORMATION SECURITY FOR CERTAIN TYPES OF https://lawecommons.luc.edu/annals/vol26/iss1/3 2 Tschider: Enhancing Cybersecurity for the Digital Health Marketplace 2017 Enhancing Cybersecurity for the Digital Health Marketplace 3 Since 2012, much has changed. Developments in consumer-facing loT technologies combined with organizational foci on medical cost reduction and value-based health care have driven development of medical device applications and equipment that are network-aware.9 Although an Internet connection alone does not increase risk criticality, network-aware devices dramatically increase exposure to a wide variety of globally dispersed threat vectors.10 Largely because of the highly complex and multi-faceted nature of cybersecurity risk, the digital health regulatory landscape has become equally complex and, in some respects, incomplete for organizations not subject to HIPAA."1 This paper aims to dem-tystify the science of cybersecurity and propose a common-sense approach to improve clarity for organizations developing medical device productsfor the digital health industry. In Part I, this Author describes the existing context for regulatory activity and the conditions precipitating increased risk. Part II describes in detail duplicative and frequently incomplete coverage within the existing regulatory framework regulated by the FDA and the OCR. In Part III, this Author proposes an adapted FDA regulatory framework to simplify and clarify regulation of the digital health marketplace. PART I: SIGNIFICANT DIGITAL HEALTH GROWTH, CYBERSECURITY RISK The United States spends nearly eighteen percent of its Gross Domestic Product (GDP) on healthcare each year, which is expected to rise to 20.1 percent by 2025.12 Organizations investing in digital health have forecasted DEVICES (Aug. 31, 2012), http://www.gao.gov/assets/650/647767.pdf. 9. John Glaser, How the Internet of Things Will Affect Health Care, Hosp. & HEALTH NETWORKS (June 4, 2015), http://www.hhnmag.comarticles/3438-how-the-internet-of- things-will-affect-health-care. 10. Networked Medical Devices: Security and Privacy Threats, SYMANTEC 7 (2011), https://www.symantec.com/content/en/us/enterprise/white-papers/b- networked_ medicaldevicesWP_21177186.en-us.pdf; see Cybersecurity of Network- Connected Medical Devices in the Netherlands, DELOITTE 1 (2015), http://www2.deloitte. com/content/dam/Deloitternl/Docum-ents/public-sector/deloitte-nl-risk-cybersecurity-of- network-connected- medical-devices-in-the-netherlands.pdf (A 'threat vector_ is a combination